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References: 



(a) DoD Directive 5205.8, subject as above, February 20, 1991 (hereby 
canceled) 

(b) DoD Instruction 5025.01 , “DoD Directives Program,” September 26, 2012 

(c) DoD Directive 5143.01, “Under Secretary of Defense for Intelligence 
(USD©),” November 23, 2005 

(d) Committee on National Security Systems Policy (CNSSP) No. 3, “National 
Policy for Granting Access to U.S. Classified Cryptographic Information,” 
October 2007 

(e) through (j), see Enclosure 1 



1. REISSUANCE AND PURPOSE 
This In struction: 

1.1. Reissues Reference (a) as a DoD Instruction in accordance with the guidance in 
Reference (b) and the authority of Reference (c). 

1.2. Updates the policies and responsibilities for the program established under Reference 
(d) to govern the granting of access to United States (U.S.) classified cryptographic information 
that is owned, controlled, and produced by or for the Department of Defense. 



2. APPLICABILITY AND SCOPE 
This In struction: 

2.1. Applies to the Office of the Secretary of Defense, the Military Departments, the Office 
of the Chairman of the Joint Chiefs of Staff, the Combatant Commands, the Office of the 
Inspector General of the Department of Defense, the Defense Agencies, the DoD Field 
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Activities, and all other organizational entities within the Department of Defense (hereafter 
referred to collectively as “the DoD Components”). 

2.2. Applies to all members of the U.S. Armed Forces, civilian employees of the Department 
of Defense and, consistent with DoD 5220.22 -M (Reference (e)), contractors, consultants, and 
other persons employed by or affiliated with the Department of Defense who have access to 
classified U.S. cryptographic information and whose duties require continuing access thereto. 
(See Section 3, below.) Accordingly, this Instruction applies to those persons who have access 
to classified U.S. cryptographic information and are assigned: 

2.2.1. As cryptographic material custodians, alternates, or their equivalents. 

2.2.2. As cryptographic key or logic producers or developers. 

2.2.3. As cryptographic maintenance, engineering, or installation technicians. 

2.2.4. To supply points where cryptographic keying materials are generated or stored, 
and to those having access to such materials. 

2.2.5. To secure telecommunications facilities located on the ground, on board ship, or 
on communications support aircraft and whose duties require keying of cryptographic 
equipment. 

2.2.6. To prepare, authenticate, or decode nuclear control orders (valid or exercise). 

2.2.7. To any other responsibility requiring or enabling access to classified cryptographic 

media. 

2.3. Does not apply to individuals whose duties are to operate (but not to key or maintain) 
systems using cryptographic equipment. 

2.4. Excludes controlled cryptographic items as defined in NTISSI No. 4001 (Reference (f)). 

2.5. Shall not alter existing authorities of the Director of National Intelligence under 
Executive Order 12333 (Reference (g)). 



3. DEFINITIONS 

For the purpose of this Instruction, classified cryptographic information is defined as: 

3.1. Cryptographic keys and authenticators that are classified in accordance with Volume 1 
of DoD Manual 5200.01 (Reference (h)) and designated as SECRET CRYPTO or TOP SECRET 
CRYPTO. 
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3.2. Classified cryptographic media that embody, describe, or implement a classified 
cryptographic logic, to include (but not be limited to) full maintenance manuals, cryptographic 
descriptions, drawings of cryptographic logic, specifications describing a cryptographic logic, 
and cryptographic software, firmware, or repositories of such software (e.g., magnetic media or 
optical disks). 



4. POLICY 

It is DoD policy that a person may be granted access to classified cryptographic information, as 
specified in sections 2 and 3, only if that person: 

4.1. Is a U.S. citizen. 

4.2. Is a civilian employee of the Department of Defense, a member of the U.S. Armed 
Forces, a DoD-cleared contractor or employee of such contractor, or is employed as a DoD 
representative (including consultants of the Department of Defense). 

4.3. Requires access to perform official duties for or on behalf of the Department of 
Defense. 

4.4. Possesses a security clearance appropriate to the level of classification of the 
cryptographic information to be accessed, in accordance with DoD 5200.2-R (Reference (i)). 

4.5. Receives a security briefing appropriate to the cryptographic information to be accessed. 

4.6. Acknowledges the granting of access by signing a cryptographic access certificate. 

4.7. Agrees to report foreign travel and any form of contact with foreign nationals, in 
accordance with Reference (i). 

4.8. Acknowledges the possibility of being subject to a counterintelligence scope polygraph 
examination administered in accordance with DoD Directive 5210.48 (Reference (j)). 



5. RESPONSIBILITIES 

5.1. The Under Secretary of Defense for Intelligence (USD(I)) shall oversee and review the 
implementation of this Instruction. 

5.2. The Heads of the DoD Components shall: 

5.2.1. Control access to classified cryptographic information in accordance with 
section 4. 
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5.2.2. Carry out and administer a cryptographic access program within their respective 
organizations. This program shall include cryptographic access briefings and execution of 
cryptographic access certificates. (See Enclosure 2 and SD Form 572, “Cryptographic Access 
Certification and Termination.” 1 ) 

5.2.3. In accordance with Reference (j), carry out a counterintelligence scope polygraph 
examination program in support of this Instruction. 

5.2.4. Maintain records on all individuals who have been granted cryptographic access or 
have had their cryptographic access withdrawn. Arrange for retention of cryptographic access 
certificates or legally enforceable facsimiles in accordance with the DoD Component records 
disposition schedules. 

5.2.5. Accept as valid the cryptographic access granted by other DoD Components. 

5.2.6. Deny or withdraw cryptographic access to those individuals who fail to agree to or 
comply with the specific criteria identified in section 4. 

5.2.7. Incorporate this policy into appropriate training and awareness programs. 



6. EFFECTIVE DATE . This Instruction is effective November 8, 2007. This Instruction must 
be reissued, cancelled, or certified current within 5 years of its publication in accordance with 
DoD Instruction 5025.01 (Reference (k)). If not, it will expire effective November 8, 2017, and 
be removed from the DoD Issuances Website. 




Under Secretary of Defense for Intelligence 



Enclosures - 2 

El. References, continued 

E2. Sample - Cryptographic Access Briefing 



1 Found at: http://www.dtic.mil/whs/directives/infomgt/forms/forminfo/forminfopage2004.html 
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El. ENCLOSURE 1 
REFERENCES , continued 



(e) DoD 5220.22-M, “National Industrial Security Program Operating Manual,” February 28, 
2006 

(f) National Telecommunications and Information Systems Security Instruction 
(NTISSI) No. 4001, “Controlled Cryptographic Items,” July 1996 

(g) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, 
as amended 

(h) DoD Manual 5200.01, Volume 1, “DoD Information Security Program: Overview, 
Classification, and Declassification,” February 24, 2012 

(i) DoD 5200.2-R, “Personnel Security Program,” January 1, 1987, as amended 

(j) DoD Directive 5210.48, “Polygraph and Credibility Assessment Program,” 

January 25, 2007, as amended 

(k) DoD Instruction 5025.01, “DoD Directives Program,” September 26, 2012 
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E2. ENCLOSURE 2 

SAMPLE - CRYPTOGRAPHIC ACCESS BRTEFTNG 



You have been selected to perform duties that will require access to classified cryptographic 
information. It is essential that you be made aware of certain facts relevant to the protection of 
this information before access is granted. You must know the reason why special safeguards are 
required to protect classified cryptographic information. You must understand the directives that 
require these safeguards and the penalties you may incur for the unauthorized disclosure and/or 
retention or negligent handling of classified cryptographic information under the criminal laws of 
the United States. Failure to properly safeguard this information could cause exceptionally grave 
damage or irreparable injury to the national security of the United States or could be used to 
advantage by a foreign nation. 

Classified cryptographic information is especially sensitive because it is used to protect other 
classified information. Any particular piece of cryptographic keying material and any specific 
cryptographic technique may be used to protect a large quantity of classified information during 
transmission. If the integrity of the cryptographic system is breached at any point, all 
information protected by the system may be compromised. The safeguards placed on classified 
cryptographic information are a necessary component of Government programs to ensure that 
our Nation's vital secrets are not compromised. 

Because access to classified cryptographic information is granted on a strict need-to-know 
basis, you will be given access to only that classified cryptographic information necessary in the 
performance of your duties. You are required to become familiar with (insert, as appropriate. 
Department or Agency implementing Directives covering the protection of cryptographic 
information) . Cited directives are attached in a briefing book for your review at this time. 

Especially important to the protection of classified cryptographic information is the 
immediate reporting of any known or suspected compromise of this information to (insert 
appropriate security office) . If a classified cryptographic system is compromised but the 
compromise is not reported, the continued use of the system can result in the loss of all 
information protected by it. If the compromise is reported, steps can be taken to lessen an 
adversary's advantage gained through the compromise of the information. 

As a condition of access to classified cryptographic information, you must acknowledge 
that you may be subject to a counterintelligence scope polygraph examination. This examination 
will be administered in accordance with DoD Directive 5210.48 and applicable law. The 
relevant questions in this polygraph examination concern espionage, sabotage, unauthorized 
disclosure of classified information and unreported foreign contacts. If at this time you do not 
wish to sign such an acknowledgment as a part of executing a cryptographic access certification, 
this briefing will be terminated and the briefing administrator will so annotate the cryptographic 
access certificate. Such refusal will not be cause for adverse action, but will result in your being 
denied access to classified cryptographic information. 
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Intelligence services of some foreign governments prize the acquisition of classified 
cryptographic information. They will go to extreme lengths to compromise U.S. citizens and 
force them to divulge classified cryptographic techniques and materials that protect the Nation's 
secrets around the world. Any personal or financial relationship with a foreign government's 
representative could make you vulnerable to attempts at coercion to divulge classified 
cryptographic information. Learn to recognize those attempts so that you may successfully 
counter them. The best personal policy is to avoid discussions that reveal your knowledge of, or 
access to, classified cryptographic information and thus avoid highlighting yourself to those who 
would seek the information you possess. Any attempt, either through friendship or coercion, to 
solicit your knowledge regarding classified cryptographic information must be reported 
immediately to (insert appropriate security office) . 

In view of the risks noted above, unofficial travel to foreign countries may require the prior 
approval of (insert appropriate security office) . It is essential that you contact (insert appropriate 
security office) before such unofficial travel. 

Finally, should you willfully or negligently disclose to any unauthorized persons any of the 
classified cryptographic information to which you will have access, you may be subject to 
administrative and civil sanctions, including adverse personnel actions, as well as criminal 
sanctions under the Uniform Code of Military Justice and/or the criminal laws of the United 
States, as appropriate. 
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